PT-2023-14753 · Python+3 · Python+4
John Gemignani
·
Published
2023-02-04
·
Updated
2025-03-26
·
CVE-2022-45786
CVSS v3.1
8.1
High
| Vector | AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
AGE for PostgreSQL 11 versions up-to-and-including 1.1.0
AGE for PostgreSQL 12 versions up-to-and-including 1.1.0
Description
There are issues with the AGE drivers for Golang and Python that enable SQL injections to occur. The problem is due to the nature of the
cypher() function, which cannot be parameterized directly. This enabled SQL injections if the developer of the driver wasn't careful. The fix is to update to the latest Golang and Python drivers in addition to the latest version of AGE that is used for PostgreSQL 11 or PostgreSQL 12. The update of AGE will add a new function to enable parameterization of the cypher() function, which, in conjunction with the driver updates, will resolve this issue.Recommendations
Update to the latest Golang and Python drivers in addition to the latest version of AGE that is used for PostgreSQL 11 or PostgreSQL 12 to resolve the issue.
As a temporary workaround, consider restricting the use of the
cypher() function until a patch is available.
Update AGE to the latest version to add a new function that enables parameterization of the cypher() function.Fix
SQL injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Age
Golang
Postgresql 11
Postgresql 12
Python